How to apply policy Rule Set ro remove headers AFTER the Log Handler rules

[Omriil]

We have a ruleset to remove XFF header for the next hop, and a Log Handler rule to send Access logs to SIEM. We wish that the data will be sent to the SIEM with the XFF header, and that the rule to remove XFF will apply later. any suggestions on how to do it?

[asabban · Accepted solution]

Hello,

you cannot apply changes to the headers after the log handler. The log handler is the end of the policy execution.

I would - in the policy - always remove the XFF header, but store its value into a user-defined property. In the log handler log the stored value from the user-defined property.

Andre

[Omriil]

Thanks for the answer!

just a thought- if i copy the value to a user-defined property and send to the SIEM, will it also pass on the next hop? because we don't want that off course